Data Requests Under GDPR to Push Cost to Public Sector Past £30 million
The impact of GDPR doesn't stop there. Further new guidelines ruling that in most cases an organisation must also complete requests free of charge are an extra blow to budgets. This marks a key change from previous guidelines under the 1998 Data Protection Act (DPA), which allowed a processing fee to be charged. As such, a £2.1m gap in income per year is expected to emerge.
The detail behind the numbers:
The figures are the result of an extensive Freedom of Information (FOI) Act request made by Exonar, a leading provider of GDPR data mapping and data inventory solutions, to 458 organisations, including NHS Trusts (206), local government (125), central government (61) and emergency services (66) from across the UK.
The FOIs asked for the number of subject access requests (SARs) received by the organisation in 2014, 2015, and 2016* and the cost of processing each SAR.
On average, a SAR cost £145.46 to process, though some bodies admitted it costs much more, sometimes running as high as £1,800 such was the complexity of finding data and the associated administration. Multiplying the average cost to complete a SAR with the number of SARs received by the respondents in 2016 (209,023), results in a total administration cost to the public sector of £30.4 million.
Each organisation could previously have recouped some of the cost and charged a recommended £10 fee to complete a SAR but under GDPR they will no longer be able to, resulting in a £2.1m deficit that is set to grow wider as more requests are made.
NHS will be hit hardest
The study found that on average each NHS Trust already receives 800 requests per year. Multiplying this by the average cost of processing SARs and then by the 241 Trusts in the UK, the total cost to the NHS of managing SARs stands at £20.6million annually. It's expected this will only go up as more people become aware of their rights.
In general, the public sector will struggle to meet SAR response deadlines
The GDPR has trimmed the amount of time that organisations have to complete SAR requests from 40 days - as per the 1998 DPA - to one month.
Exonar's research found that many organisations struggled to meet the deadline for providing answers to its FOI requests (requests must be completed within 20 working days), highlighting the difficulty that many will face complying with requests under the new GDPR requirements.
The time to respond to an FOI varied from one day to 159 days. On average it took 24 days, with the NHS averaging 27, emergency services 21, central government 22 and local government 23 days.
Some Trusts can't put a figure on the cost of processing a SAR
Some NHS Trusts declined to provide a figure such was the complexity of finding all the data related to a person. One such Trust was Calderdale and Huddersfield NHS Foundation Trust, which though couldn't provide a figure, highlighted that the costs would include 3 WTE band 2 staff (approx. £16,500 pa each), plus costs such as discs costing £1,044/year, envelopes with an annual cost of £40, and postage costs at £1.48 per patient.
The Trust added that this would be a minimum cost and there are other costs that "cannot be quantified", such as involvement of management, clinicians, physio and health visitors, finance and even X-ray costs.
Adrian Barrett, CEO and founder of Exonar, said that the variance in time taken to respond demonstrates how complex a task SARs are in the public sector: "The good news is the public sector is taking its responsibility to do a thorough job and find all the data pertaining to a person seriously. However, there's a heavy process burden, especially when multiple bodies are involved, and the NHS in particular needs an alternative to manpower to trace data if it is to avoid penalties of non-compliance."
Adrian adds that digital initiatives in the public sector have to be accelerated to relieve the burden on the public purse: "Our estimates on the costs of managing SARs is probably conservative but we do expect an immediate bow wave in response to all the GDPR emails we saw in May and June.
"Because the public now knows about the GDPR they are more likely to raise more SARs, and if there is a sudden wave of requests the public sector will be stretched further. It's clear that the government needs to take advantage of new technology, particularly artificial intelligence, to help the public sector become more efficient with handling, organising and retrieving its data."